论文标题
脂肪：联邦对抗训练
FAT: Federated Adversarial Training
论文作者
论文摘要
联合学习（FL）是解决机器学习（ML）中隐私和数据治理问题的最重要范式之一。到目前为止，已经出现了对抗性训练，这是针对ML模型逃避威胁的最有希望的方法。在本文中，我们采取了第一个已知步骤，将两种方法结合在一起，以减少推断期间逃避威胁的同时保留培训期间的数据隐私。我们研究了使用MNIST，Fashion-Mnist和CIFAR10的脂肪方案对理想化的联合设置的有效性，并提供了有关稳定在LEAF基准数据集中培训的第一个见解，该数据集专门模仿了联合学习环境。我们通过在实现对抗性鲁棒性方面的自然扩展对抗性训练来确定挑战，并在客户存在破坏模型融合的情况下进一步检查理想化的环境。我们发现，修剪的平均值和Bulyan防御能力可能会受到损害，我们能够以一种新型的基于蒸馏的攻击来颠覆KRUM，该攻击向防御者呈现了一个显然是“健壮”模型的模型，而实际上该模型未能为简单的攻击修改提供鲁棒性。
Federated learning (FL) is one of the most important paradigms addressing privacy and data governance issues in machine learning (ML). Adversarial training has emerged, so far, as the most promising approach against evasion threats on ML models. In this paper, we take the first known steps towards federated adversarial training (FAT) combining both methods to reduce the threat of evasion during inference while preserving the data privacy during training. We investigate the effectiveness of the FAT protocol for idealised federated settings using MNIST, Fashion-MNIST, and CIFAR10, and provide first insights on stabilising the training on the LEAF benchmark dataset which specifically emulates a federated learning environment. We identify challenges with this natural extension of adversarial training with regards to achieved adversarial robustness and further examine the idealised settings in the presence of clients undermining model convergence. We find that Trimmed Mean and Bulyan defences can be compromised and we were able to subvert Krum with a novel distillation based attack which presents an apparently "robust" model to the defender while in fact the model fails to provide robustness against simple attack modifications.
